// @ts-ignore
// @ts-nocheck
/*
创建函数指针
void CefFrameHostImpl::SendJavaScript(
  const std::u16string& jsCode,
  const std::string& scriptUrl,
  int startLine) {

48 89 44 24 50 0F B6 42 17 84 C0 79 06 49 8B 46 08 EB 03 83 E0 7F 48 85 C0

00007FF8176398DC                    | 48:83EC 58               | sub rsp,58                                   |
00007FF8176398E0                    | 4C:89C7                  | mov rdi,r8                                   |
00007FF8176398E3                    | 49:89D6                  | mov r14,rdx                                  | rdx:&L"window.postMessage( 'window_gotfocus', '*' );"
00007FF8176398E6                    | 48:89CE                  | mov rsi,rcx                                  |
00007FF8176398E9                    | 48:8B05 48870E0B         | mov rax,qword ptr ds:[7FF822722038]          |
00007FF8176398F0                    | 48:31E0                  | xor rax,rsp                                  |
  00007FF8176398F3                    | 48:894424 50             | mov qword ptr ss:[rsp+50],rax                |
  00007FF8176398F8                    | 0FB642 17                | movzx eax,byte ptr ds:[rdx+17]               |
  00007FF8176398FC                    | 84C0                     | test al,al                                   |
  00007FF8176398FE                    | 79 06                    | jns libcef.7FF817639906                      |
00007FF817639900                    | 49:8B46 08               | mov rax,qword ptr ds:[r14+8]                 |
00007FF817639904                    | EB 03                    | jmp libcef.7FF817639909                      |
00007FF817639906                    | 83E0 7F                  | and eax,7F                                   |
00007FF817639909                    | 48:85C0                  | test rax,rax                                 |
00007FF81763990C                    | 75 1F                    | jne libcef.7FF81763992D                      |
00007FF81763990E                    | 48:8B4C24 50             | mov rcx,qword ptr ss:[rsp+50]                |
00007FF817639913                    | 48:31E1                  | xor rcx,rsp                                  |
00007FF817639916                    | E8 85DE1D04              | call libcef.7FF81B8177A0                     |
00007FF81763991B                    | 90                       | nop                                          |
00007FF81763991C                    | 48:83C4 58               | add rsp,58                                   |
00007FF817639920                    | 5B                       | pop rbx                                      | rbx:&L"window.postMessage( 'window_gotfocus', '*' );"
00007FF817639921                    | 5D                       | pop rbp                                      |
00007FF817639922                    | 5F                       | pop rdi                                      |

*/
let log = console.log

function 生成字符串_std_u16string(ptr, len): NativePointer {
  let ret = Memory.alloc(8*4);
  ret.writePointer(ptr);
  ret.add(8).writeU64(len);
  ret.add(0x10).writeU64(len);
  ret.add(0x14).writeU32(0x80000000);
  return ret;
}

function 生成字符串_std_u16string_null(): NativePointer {
  let ret = 生成字符串_std_u16string(ptr(0), 0);
  // 长度为0时，不能有0x80000000标记。
  ret.add(0x14).writeU32(0);
  return ret;
}

function 生成全局js() {
  // let _js = "console.log( '2024-07-21 khz xyz000' );";
  let _js = `document.querySelector('button[type="submit"]').style.cssText='pointer-events:none';document.querySelector('input[type="text"]').value='abc=====';`;
  let js = Memory.allocUtf16String(_js);
  global.js = js;
  global.jsCode = 生成字符串_std_u16string(js, _js.length);
  global.scriptUrl = 生成字符串_std_u16string_null();
  console.log('global.js ', global.js, global.jsCode, global.scriptUrl)
  log('js', js)
  return js
}

function 遍历所有frame(m) {
  let addr_on_jsdialog = null;
  let exec_js_addr_call = null;
  let exec_js_offset_info_manager_call = 0x2831E0;
  let exec_js_offset_info_list = 0x20;
  let exec_js_offset_info_list_size = 0x10;
  let exec_js_offset_begin = 0x10;
  let exec_js_offset_impl = 0x98;
	// No host found for chrome popup browser
  // 00007FF8176031E0                    | 48:8B05 011D1F0B         | mov rax,qword ptr ds:[7FF8227F4EE8]          | 00007FF8227F4EE8:"€A+"
  // 00007FF8176031E7                    | C3                       | ret                                          |
  function GetCefBrowserInfoManager(addr_func)
	{
		// DWORD64(*func)();
    let func = new NativeFunction(addr_func, 'pointer', [], {abi: 'win64'});
		// MY_WRITE_DWORD64(&func, addr_func);
		return func();
	}

  let addr_func = m.add(exec_js_offset_info_manager_call);
  let obj_info_manager = GetCefBrowserInfoManager(addr_func)
  log('obj_info_manager', obj_info_manager.toString(16))
  let info_list = obj_info_manager.add(exec_js_offset_info_list)
  let info_list_size = info_list.add(exec_js_offset_info_list_size).readU32();
  log('info_list', info_list.toString(16), info_list_size);
  let iter_list = info_list.readPointer();
  for(let i=0; i<info_list_size; i++) {
    let ptrCefBrowserInfo = iter_list.add(exec_js_offset_begin).readPointer();
    let main_frame = ptrCefBrowserInfo.add(exec_js_offset_impl).readPointer();
    log('main_frame', main_frame.toString(16))

    iter_list = iter_list.readPointer();
  }
}

function test(m) {
  遍历所有frame(m)
}

export function SendJavaScript() {
  log('SendJavaScript()');
  let m = Module.getBaseAddress('libcef.dll');
  return test(m);
  生成全局js();

  const pattern = '48 89 44 24 50 0F B6 42 17 84 C0 79 06 49 8B 46 08 EB 03 83 E0 7F 48 85 C0';
  log('m.base, m.size, pattern', m, m.base, m.size, pattern)
  let addrs = Memory.scanSync(m, 0x1000000, pattern)
  // addrs.forEach((m) => {
  //   log(`found ${m.address}`);
  // })

  let func_addr = addrs[0].address.sub(0x23);
  log('func_addr', func_addr);
  let func = new NativeFunction(func_addr, 'void', ['pointer', 'pointer', 'pointer', 'int'], {abi: 'win64'})
  let ecx = new NativePointer("0x000035D80034C800");
  // let jsCode = ptr('0x00007FF8210C6F6C'); // Memory.allocUtf16String("alert( 'window_gotfocus' ); ");
  // let scriptUrl = ptr('0x00007FF8210C6F6C'); // Memory.allocUtf8String("alert( 'window_gotfocus' );");
  // log('jsCode, scriptUrl =  ', jsCode, scriptUrl)
  func(ecx, global.jsCode, global.scriptUrl, 0);
  
  log('Leave SendJavaScript()');
}

// exports {
//   SendJavaScript,
// }